last command in Linux with Examples – View history of user logins
This last command guide is a follow-up of my previous 90 Linux Commands frequently used by Linux Sysadmins article. Every week, or as time allows, I will publish articles on around 90 commands geared toward Linux sysadmins and Linux power users. Let’s continue this series with the
You may be working with other system administrators and developers who all have to log in to the same system. At some point, you will want to view a list of the last users who logged in, from where, and what time. Meet the last command for Linux and Unix-like systems.
last command examples
last command usually reads from the log file
/var/log/wtmp and prints the history of successful user login attempts as well as any currently logged-in users. The last logged-in users appear at the top of the list. We will also look at similar commands, namely:
To view last logins, their duration, and other details, use:
To show only the last 10 logins, use:
last -n 10
To print the full date and time of entries with their IPs, use:
To view all logins by a specific user and show the IP address instead of the hostname, use:
To view all recorded reboots, use:
To view all recorded shutdowns, use:
To check when was the file
/var/log/wtmp was written last, use:
You can also filter by users or ttys, in which case
last will show only entries matching those arguments. Ttys can be abbreviated. For example,
last 7 is the same as
lastb command examples
lastb is the same as
last, except that it shows the log of the last failed login attempts.
To show a list of all failed login attempts, use:
To show a list of failed login attempts since a given time, use:
sudo lastb --since YYYY-MM-DD
To show a list of failed login attempts until a given time, use:
sudo lastb --until YYYY-MM-DD
To show a list of all failed login attempts at a specific time, use:
sudo lastb --present hh:mm
These options apply to both
Screenshot and below excerpt are from:
-a, –hostlast – Display the hostname in the last column. Useful in combination with the –dns option.
-d, –dns – For non-local logins, Linux stores not only the hostname of the remote host but its IP number as well. This option translates the IP number back into a hostname.
-f, –file – Tell last to use a specific file instead of /var/log/wtmp. The –file option can be given multiple times, and all of the specified files will be processed.
-F, –fulltimes – Print full login and logout times and dates.
-i, –ip – Like –dns , but displays the host’s IP number instead of the name.
-n, –limit number – Tell last how many lines to show.
-p, –present time – Display the users who were present at the specified time. This is like using the
options –since and –until together with the same time.
-R, –nohostname – Suppresses the display of the hostname field.
-s, –since time – Display the state of logins since the specified time. This is useful, e.g., to easily determine who was logged in at a particular time. The option is often combined with –until.
-t, –until time – Display the state of logins until the specified time.
–time-format format – Define the output timestamp format to be one of notime, short, full, or iso. The notime variant will not print any timestamps at all, short is the default, and full is the same as the –fulltimes option. The iso variant will display the timestamp in ISO-8601 format. The ISO format contains timezone information, making it preferable when printouts are investigated outside of the system.
-w, –fullnames – Display full user names and domain names in the output.
-x, –system – Display the system shutdown entries and run level changes.
lastlog command with examples
Also useful is the
lastlog command. The
lastlog command shows the most recent login for all users or a specific user.
To show the most recent login of all users, use:
To show a record of the specific user, use:
lastlog -u username
To show logins older than 1 day, use:
lastlog -b 1
To show records more recent than 7 days, use:
lastlog -t 7
Sorting the output:
For all of these commands (last, lastb, and lastlog), you can reverse the output using
tac. For example:
last | tac
- who – print who is currently logged in.
- w – a quick summary of every user logged into a computer.
- lastcomm – List Last Executed Commands of User.
If you are accessing Linux servers along with other system administrators and developers,
lastlog provide a fast way to view a list of last and currently logged-in users.